# DevSecOps and the software supply chain · Scope and trust boundaries

Blank workpaper, not completed testing or approval. Do not include secrets or real personal data.

## Product / revision / environment

[ ] Complete; add evidence and owner.

## Written authorization, scope and stop contact

[ ] Complete; add evidence and owner.

## Actor / tenant / asset / trust boundary

[ ] Complete; add evidence and owner.

## Assumptions / prerequisites / exclusions

[ ] Complete; add evidence and owner.

## Module-specific evidence

- Tool/rule/version/scope and exit codes
- Digest-bound SBOM, provenance and approval